High · 8.8 CVE-2021-36225 EUVD-2021-22845GHSA-w72f-88g7-j8wf

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware …

Published Feb 6, 2023 · Updated Mar 26, 2025 · Assigned by mitre

Description

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation.

References

https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/
https://www.youtube.com/watch?v=vsg9YgvGBec
https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md